Thanks Jochen,
After a lot of trial and error I've learned you have to involve "the
backlog object" or you can't access your fields. My callback eventually
looked something like this:
ACCOUNT LOCKED OUT
${if backlog}
${foreach backlog message}
Username: ${message.fields.ad_username}
Server: ${message.fields.source}
Client: ${message.fields.machine_name}
Time: ${message.fields.EventReceivedTime}
${end}${else}<No backlog> ${end}
On Tuesday, 31 May 2016 12:19:56 UTC-4, Jochen Schalanda wrote:
>
> Hi Dennis,
>
> you can only reference fields listed in
> http://docs.graylog.org/en/1.3/pages/streams.html#alert-callbacks-types-explained
>
> in your email template (scroll down a little bit).
>
> In your case, you would access the ad_username field of the message with
> ${message.fields.ad_username}.
>
> Cheers,
> Jochen
>
> On Tuesday, 31 May 2016 17:58:33 UTC+2, Dennis Seaton wrote:
>>
>> I have an extractor that pulls the username whenever someone is locked
>> out of my Windows domain. It puts the username into a field called
>> *ad_username*. I now want to use that custom field that I made inside an
>> email callback so I can send extremely simplified email alerts like this:
>>
>> *A user was locked out of the domain at ${check_result.triggeredAt} *
>> *The user was: ${ad_username}*
>>
>> I've seen the Callback documentation here
>> <http://docs.graylog.org/en/1.3/pages/streams.html#alert-callbacks-types-explained>
>> but
>> it is lacking detail on how to do this.
>>
>> Can anyone tell me if it's possible? How can I use my own fields in the
>> callbacks?
>>
>>
>>
>> Thanks in advance
>>
>>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/e1fef9de-cf9c-4518-b48d-6b2e0bbb8b6d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
